harbor
v2.15.5An open source trusted cloud native registry project that stores, signs, and scans content.
- Maintenance
- Active216 commits in 3 months · bus factor 4
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 30 advisories11 high, 16 medium, 3 low · Scorecard 7.7/10
- Supported versions
- 3 lines supportednewest 2.15 · oldest 2.13 · 9 ended
29.7k stars · 5.4k forks · 1.1k open issues · last release 3 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 11 high, 16 medium, 3 low. Check the patched version against the one you run.
- highGHSA-x955-mxjx-g5cjOct 28, 2026Unauthenticated PUT request to /api/v2.0/users crashes Harbor core
- Affected
- >= 2.13.0, <= 2.13.6; >= 2.14.0, <= 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.15.3, 2.14.6,2.16.0
- mediumGHSA-jw3v-7jvc-pfmxOct 6, 2026Webhook error responses can cause unbounded decompression in Jobservice
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- highGHSA-qj39-pjf2-wmrcOct 6, 2026Path traversal vulnerability in distribution endpoints
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- highGHSA-w5fq-xrhj-j7g2Oct 6, 2026A system robot with user:update makes itself a system administrator
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- highGHSA-xq2m-cj8w-56v5Oct 6, 2026Robot "cover all projects" scope collapses into a global wildcard, conferring the deliberately-ungrantable robot:update — enabling cross-project robot takeover with owner lockout
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- mediumGHSA-vwvv-675v-p6rrOct 6, 2026scanner_registration.access_cred is missing filter:"false", giving a project admin a blind oracle over the scanner credential
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- mediumGHSA-884q-mjcg-86x4Oct 6, 2026Scanner bearer authorization request disables TLS verification and reads the full response body
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- mediumGHSA-27f2-qg57-2gwgOct 6, 2026Immutable tag rule matcher only evaluates first repository/tag selector, allowing multi-selector rules to be bypassed
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- highGHSA-xvh7-74g6-29xwOct 6, 2026External auth-proxy identity named admin inherits Registry system-administrator authorization
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- lowGHSA-3x7c-wf86-mjx6Oct 6, 2026Security middleware continues after AuthMode lookup failure
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- mediumGHSA-xgp2-5vxg-rgh2Oct 6, 2026SSRF and credential disclosure via attacker-controlled pagination Link header in the registry replication client
- Affected
- >= 2.0.0, < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- mediumGHSA-wjpm-hv5w-gxr6Oct 6, 2026Registry chunk upload reuses unvalidated Location headers
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- mediumGHSA-wrw5-gmvj-gf23Oct 6, 2026Vulnerability & Content-Trust pull policies bypassable via attacker-controlled `User-Agent` header
- Affected
- < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- highGHSA-2phj-cp9f-qq6wOct 6, 2026SSRF in webhook delivery allows ProjectAdmin to reach internal services and cloud metadata endpoints
- Affected
- >= 1.7.0, < 2.13.6; >= 2.14.0, < 2.14.5; >= 2.15.0, < 2.15.3
- Patched in
- 2.13.6; 2.14.5; 2.15.3, 2.16.0
- lowGHSA-56j8-6qr5-cg75Apr 7, 2026About CVE-2026-4404
- Affected
- >1.0.0
- Patched in
- N/A
- mediumGHSA-prh4-vhfh-24mjMar 25, 2026LDAP password and OIDC secret is not redacted in the audit log
- Affected
- >2.13.0, <2.14.3
- Patched in
- v2.15.0, v2.14.3, v2.13.5
- mediumCVE-2025-30086Jul 23, 2025Possible ORM Leak Vulnerability in the Harbor
- Affected
- <=2.13.0, <=2.12.3
- Patched in
- 2.13.1, 2.12.4
- mediumCVE-2025-32019Jul 23, 2025XSS vulnerability in the Harbor repository description
- Affected
- <=2.12.2, <=2.11.2, <2.13.1
- Patched in
- 2.12.4, 2.13.1
- mediumCVE-2024-22278Jul 31, 2024Harbor fails to validate the user permissions when updating project configurations
- Affected
- <v2.9.5, <v2.10.3
- Patched in
- v2.9.5, v2.10.3, v2.11.0
- mediumCVE-2024-22244May 31, 2024Open Redirect URL in Harbor
- Affected
- <=v2.8.4, <=v2.9.2,<=v2.10.0
- Patched in
- v2.8.5, v2.9.3, v2.10.1
- lowCVE-2024-22261May 31, 2024SQL Injection in Harbor scan log API
- Affected
- >=v2.8.1, >=2.9.0, >=2.10.0
- Patched in
- v2.8.6, v2.9.4, v2.10.2
- mediumCVE-2023-20902Oct 8, 2023Timing attack risk in Harbor
- Affected
- <2.8.3 <2.7.3 <1.10.18
- Patched in
- v2.8.3, v2.7.3, v1.10.18
- highGHSA-j7jh-fmcm-xxwvMar 31, 2023Harbor insecure default configuration when installed with Harbor-helm
- Affected
- 1.3.x <=1.3.17, 1.4.x, 1.5.x, 1.6.x, 1.7.x, 1.8.x, 1.9.x <=1.9.5, 1.10.x<=1.10.3, 1.11.0
- Patched in
- v1.3.18, v1.9.6, 1.10.4, and v1.11.1
- mediumCVE-2022-31667Aug 29, 2022Harbor fails to validate the user permissions when updating a robot account
- Affected
- 2.x<=2.4.2; 2.5<=<2.5.1
- Patched in
- 2.4.3+; 2.5.2+
- mediumCVE-2022-31669Aug 29, 2022Harbor fails to validate the user permissions when updating tag immutability policies
- Affected
- 2.x<=2.4.2; 2.5<=<2.5.1
- Patched in
- 2.4.3+; 2.5.2+
- highCVE-2022-31671Aug 29, 2022Harbor fails to validate the user permissions when updating p2p preheat policies
- Affected
- 2.x<=2.4.2; 2.5<=<2.5.1
- Patched in
- 2.4.3+; 2.5.2+
- mediumCVE-2022-31666Aug 29, 2022Harbor fails to validate user permissions while deleting Webhook policies
- Affected
- 2.x<=2.4.2; 2.5<=<2.5.1
- Patched in
- 2.4.3+; 2.5.2+
- highCVE-2022-31666Aug 29, 2022Harbor fails to validate the user permissions when updating Webhook policies
- Affected
- 2.x<=2.4.2; 2.5.<=2.5.1
- Patched in
- 2.4.3+; 2.5.2+
- highCVE-2022-31666Aug 29, 2022Harbor fails to validate the user permissions when viewing Webhook policies
- Affected
- 2.x < 2.4.3; 2.5<2.5.2
- Patched in
- 2.4.3+; 2.5.2+
- highCVE-2022-31670Aug 29, 2022Harbor fails to validate the user permissions when updating tag retention policies
- Affected
- 1.x<=1.10.12; 2.x<=2.4.2; 2.5<=<2.5.1
- Patched in
- 1.10.13+; 2.4.3+; 2.5.2+